DPA case 2025-31-2078 – Complaint Upheld (Denmark, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A former employee complained after their request for access to personal data was denied by their employer. The authority upheld the employer's decision, stating that the refusal was justified due to ongoing criminal proceedings. This case shows that companies can refuse access to data if there are compelling legal reasons.
What happened
The employer denied a former employee's request to access data used in their dismissal decision.
Who was affected
The former employee, who sought access to their personal data, was affected by this decision.
What the authority found
The authority found that the employer was justified in refusing the access request due to compelling legal interests.
Why this matters
This ruling illustrates that companies can refuse data access requests under certain legal circumstances, emphasizing the need for clear communication about data rights.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The DPA received a complaint from a former employee (data subject) of the controller concerning the refusal of an access request. More specifically, the data subject was dismissed by the controller on the basis of having gained access to the data subjects’ correspondence with another employee on Messenger. The data subject therefore requested access to the material on which the employer had based the decision. The controller clarified that the correspondence which was the basis of its decision to refuse access was discovered by chance on another employees work phone when they had turned it in following their resignation. The controller further emphasised that it took into consideration the criminal proceedings that had been initiated concerning the access of the correspondence. Particularly the fundamental need to safeguard the controller’s legal position in light of those proceedings. The data subject on the other hand argued that whilst refusal to an access request is allowed this should not result in refusal to all personal data and information of the data subject. The data subject also argued unlawful obtention of the correspondence by the controller and the corresponding compelling interests of the data subject as a result thereof, to be provided with a copy of the information. Finally, the data subject emphasised the fact that controller did not provide specific information as to the grounds for refusal. That being clear identification of which rights and freedoms would be violated if the data subject had obtained a copy, and the compelling public interest which outweighs those of the data subject. The DPA held that the controller acted within the limits of its right to refuse an access request in accordance with Article 15(4) GDPR, where the data subject’s interests are outweighed by compelling private and public interests. In this regard, as a result of the material to which the data subject had requested access was also the subject of criminal proceedings
Outcome
Complaint Upheld
A data subject complaint that was upheld by the DPA.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-31-2078 in DK
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-31-2078 - Denmark (2026). Retrieved from cookiefines.eu
Last updated: